freeipa

#9782 selinux avc when installing dns server in selinux enforcing mode
Closed: fixed by frenaud. Opened by frenaud.

Closed: fixed
Reopen Issue

Issue

ipa-server-install --setup-dns fails in FIPS mode on Fedora 42. See for instance the logs in our artifacts server in https://$SERVER/idm-ci/freeipa_upstream_nightly/Nightly-latest-testing-repo-selinux/master/2025-05-07_17-10/latest-testing-repo-selinux/automember/1/report.html?sort=result

The installer fails at the end when it tries to restart ipa service and a few steps earlier when restarting dnskeysyncd:

DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 Restarting ipa-dnskeysyncd
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 Failed to start ipa-dnskeysyncd
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 Restarting named
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 Updating DNS system records
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 Configuring SID generation
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557   [1/8]: adding RID bases
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557   [2/8]: creating samba domain object
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557   [3/8]: adding admin(group) SIDs
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557   [4/8]: updating Kerberos config
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 'dns_lookup_kdc' already set to 'true', nothing to do.
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557   [5/8]: activating sidgen task
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557   [6/8]: restarting Directory Server to take MS PAC and LDAP plugins changes into account
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557   [7/8]: adding fallback group
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557   [8/8]: adding SIDs to existing users and groups
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 This step may take considerable amount of time, please wait..
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 Done.
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 Configuring client side components
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 Using existing certificate '/etc/ipa/ca.crt'.
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 Client hostname: master.ufreeipa.test
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 Realm: UFREEIPA.TEST
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 DNS Domain: ufreeipa.test
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 IPA Server: master.ufreeipa.test
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 BaseDN: dc=ufreeipa,dc=test
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 Configured /etc/sssd/sssd.conf
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 Systemwide CA database updated.
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 Adding SSH public key from /etc/ssh/ssh_host_rsa_key.pub
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 Adding SSH public key from /etc/ssh/ssh_host_ecdsa_key.pub
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 Adding SSH public key from /etc/ssh/ssh_host_ed25519_key.pub
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 SSSD enabled
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 Configured /etc/openldap/ldap.conf
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 Configured /etc/ssh/ssh_config
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 Configured /etc/ssh/sshd_config.d/04-ipa.conf
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 Configuring ufreeipa.test as NIS domain.
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 This program will set up IPA client.
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 Version 4.13.0.dev202505071340+git
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 Client configuration complete.
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 The ipa-client-install command was successful
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 Enabling and restarting the IPA service
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 CalledProcessError(Command ['/bin/systemctl', 'restart', 'ipa.service'] returned non-zero exit status 1: 'Job for ipa.service failed because the control process exited with error code.\nSee "systemctl status ipa.service" and "journalctl -xeu ipa.service" for details.\n')
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:557 The ipa-server-install command failed. See /var/log/ipaserver-install.log for more information
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd37:transport.py:217 Exit code: 1

Reproduced with the build from 202505071340 using commit 56261bbba4355c33a002df98566b290ef9681c0c

ausearch-master.ufreeipa.test.log
journal
master.ufreeipa.test_var_log_ipaserver-install.log

From ipa-server-install.log:

2025-05-07T18:07:25Z DEBUG args=['/bin/systemctl', 'restart', 'ipa-dnskeysyncd.service']
2025-05-07T18:07:25Z DEBUG Process finished, return code=1
2025-05-07T18:07:25Z DEBUG stdout=
2025-05-07T18:07:25Z DEBUG stderr=Job for ipa-dnskeysyncd.service failed because the control process exited with error code.
See "systemctl status ipa-dnskeysyncd.service" and "journalctl -xeu ipa-dnskeysyncd.service" for details.
2025-05-07T18:07:25Z DEBUG Failed to start ipa-dnskeysyncd: CalledProcessError(Command ['/bin/systemctl', 'restart', 'ipa-dnskeysyncd.service'] returned non-zero exit status 1: 'Job for ipa-dnskeysyncd.service failed because the control process exited with error code.\nSee "systemctl status ipa-dnskeysyncd.service" and "journalctl -xeu ipa-dnskeysyncd.service" for details.\n')

From journal:

May 07 18:07:25 master.ufreeipa.test systemd[1]: Starting ipa-dnskeysyncd.service - IPA key daemon...
May 07 18:07:25 master.ufreeipa.test audit[29955]: AVC avc:  denied  { relabelto } for  pid=29955 comm="systemd-tmpfile" name="softhsm_pin" dev="vda4" ino=38440 scontext=system_u:system_r:systemd_tmpfiles_t:s0 tcontext=system_u:object_r:ipa_dnskey_t:s0 tclass=file permissive=0
May 07 18:07:25 master.ufreeipa.test systemd-tmpfiles[29955]: Unable to fix SELinux security context of /var/lib/ipa/dnssec/softhsm_pin: Permission denied
May 07 18:07:25 master.ufreeipa.test audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=ipa-dnskeysyncd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
May 07 18:07:25 master.ufreeipa.test systemd[1]: ipa-dnskeysyncd.service: Control process exited, code=exited, status=73/CANTCREAT
May 07 18:07:25 master.ufreeipa.test systemd[1]: ipa-dnskeysyncd.service: Failed with result 'exit-code'.
May 07 18:07:25 master.ufreeipa.test systemd[1]: Failed to start ipa-dnskeysyncd.service - IPA key daemon.

The following AVC are reported:

----
time->Wed May  7 18:07:25 2025
type=AVC msg=audit(1746641245.314:4080): avc:  denied  { relabelto } for  pid=29955 comm="systemd-tmpfile" name="softhsm_pin" dev="vda4" ino=38440 scontext=system_u:system_r:systemd_tmpfiles_t:s0 tcontext=system_u:object_r:ipa_dnskey_t:s0 tclass=file permissive=0
----
time->Wed May  7 18:07:52 2025
type=AVC msg=audit(1746641272.725:4228): avc:  denied  { relabelto } for  pid=31617 comm="systemd-tmpfile" name="softhsm_pin" dev="vda4" ino=38440 scontext=system_u:system_r:systemd_tmpfiles_t:s0 tcontext=system_u:object_r:ipa_dnskey_t:s0 tclass=file permissive=0
----
time->Wed May  7 18:08:40 2025
type=AVC msg=audit(1746641320.874:4279): avc:  denied  { relabelto } for  pid=32461 comm="systemd-tmpfile" name="softhsm_pin" dev="vda4" ino=38440 scontext=system_u:system_r:systemd_tmpfiles_t:s0 tcontext=system_u:object_r:ipa_dnskey_t:s0 tclass=file permissive=0

We need to add

allow systemd_tmpfiles_t ipa_dnskey_t:file relabelto;

because systemd-tmpfiles first creates files under its own context and then relabels. I wonder why this wasn't visible in the PRCI runs?

Metadata Update from @frenaud:
- Issue assigned to frenaud

PRCI does not set selinux enforcing mode by default, that's why it didn't detect the issue.
The job description needs to be updated with selinux_enforcing: True to switch to enforcing mode.

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/7807

master:

  • c2aae876f04c127b7b2eb6dad8677a3ae8ceefb8 dns install: fix selinux avc relabelto

ipa-4-12:

  • 0aff65d9453d456c7a99c1294dde8c2e2ab57ca8 dns install: fix selinux avc relabelto

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata

test-failure

None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.